> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/protect/key-vault/set-up-azure-key-vault.md).
# Set Up Azure Key Vault
GuardWare PROTECT uses Azure Key Vault to store the encryption keys securely. Azure Key Vault is a cloud service that provides centralised, secure storage for secrets such as encryption keys, passwords, certificates, and connection strings. By integrating with Azure Key Vault, GuardWare PROTECT ensures that encryption keys are never exposed within the application environment and remain under strict access control.
You can set up Azure Key Vault manually [through the Microsoft Azure Portal](#set-up-azure-key-vault-through-the-azure-portal) or [through the Management Console](#set-up-azure-key-vault-through-the-management-console).
We recommend setting up through the Management Console since it automates most of the required configurations.
## Prerequisites
Before setting up Azure Key Vault, ensure you have:
* An active Microsoft Azure subscription. We recommend using a *Pay-As-You-Go* subscription.
* A Microsoft Azure account with the required administrative permissions to access the Azure portal (for example, **Global Administrator** or **Key Vault Administrator**).
* The **Owner** role assigned to the admin for your Azure subscription. If the admin account does not have the **Owner** role, follow the steps below to assign it in the Azure portal.
### Assign Owner role to Your Azure Subscription
1. Log in to the [Azure Portal](https://portal.azure.com/auth/login/) and search and click **Subscriptions.**
2. Select your subscription.
3. Go to **Access control (IAM)** and click **Role assignments**.
4. Check if the admin account used to set up the Key vault has the **Owner** permission. If not, click **+Add > Add role assignment**.
5. In the **Role** tab, click **Privileged administrator roles**.
6. Select **Owner** and click **Next**.
7. In **Assign access to**, select **User, group, or service principal.**
8. Click **+ Select members,** search and select the user and click **Select.**
9. Click **Next**.
10. In What user can do, select **Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended)** and click **Next.**
11. Review the details and click **Review +assign**.
## Set up Azure Key Vault through the Management Console
GuardWare can automatically set up the required configuration for Azure Key Vault in your Azure environment, including creating an Azure Key Vault and assigning the necessary permissions.
{% stepper %}
{% step %}
#### Log in with Azure
1. Navigate to ***PROTECT > Key Vault***.
2. Click **Log in with Azure**.
3. Log in with your admin account.
4. If your account is protected by multi-factor authentication (MFA), you'll need to approve the sign-in request. This might involve:
1. Approving a notification in the Microsoft Authenticator app.
2. Entering the code from your authenticator app.
3. Responding to a text message or phone call, depending on your MFA settings.
5. After authenticating, you'll see a permissions consent screen listing what PROTECT is requesting access to. Click **Accept**.\
{% endstep %}
{% step %}
#### Create Azure Key Vault
1. **Subscription:** Select your subscription.
2. **Resource group:** Choose existing or create new. Copy and store the Resource group name; you’ll need it to set up PROTECT Management Console.
3. **Key vault name:** Enter a unique name (e.g., `gwprotect-vault-prod`). Copy the name and store it securely. This is the AZURE KEY VAULT NAME that you’ll need to set up PROTECT Management Console.
4. **Region:** Select the appropriate region.
5. **Pricing tier:** Select your pricing.
6. Click **Create**.
{% endstep %}
{% endstepper %}
After the Key Vault is created, all the required Role-Based Access Control (RBAC) roles needed for GuardWare PROTECT to securely access the Key Vault, manage key operations, and control resource-level permissions are automatically assigned.
## Set up Azure Key Vault through the Azure Portal
{% hint style="warning" %}
Before setting up, ensure you have:
* An active Microsoft Azure subscription. We recommend using a *Pay-As-You-Go* subscription.
* A Microsoft Azure account with the required administrative permissions to access the Azure portal (for example, **Global Administrator** or **Key Vault Administrator**).
* The **Owner** role assigned to the admin for your Azure subscription. If the admin account does not have the **Owner** role, follow the steps [here](#assign-owner-role-to-your-azure-subscription).
{% endhint %}
During this process, make sure to **note down and securely store** the following details, as they will be required later while setting up the PROTECT Management Console:
* **Azure Client ID (App ID)**
* **Azure Subscription ID**
* **Azure Key Vault Name**
* **Resource Group**
{% stepper %}
{% step %}
#### **Integrate Microsoft 365**
1. In the Management Console, navigate to **ORGANISATION** > **Integrations**.
2. In the **Microsoft 365 Integration** section, click **Connect Microsoft 365** and follow the necessary steps. See [Integration](/organisation/integrations/microsoft-365.md) for more details.
{% hint style="info" %}
Configuring Microsoft 365 successfully creates an application (Service Principal) in Azure and grants the required API permissions to the application:
{% endhint %}
{% endstep %}
{% step %}
#### Create a Key Vault
Azure Key Vault is where GuardWare PROTECT securely stores and manages the encryption keys used for data protection. By creating a dedicated Key Vault, you ensure sensitive keys remain under strict access control and are available only to the authorised Service Principal.
1. Go to the [Azure Portal](https://portal.azure.com/auth/login/), sign in with your Azure Administrator account, and search for **Key vaults** and click the first result.
2. Click **+Create**.
3. In **Basics**, configure:
1. **Subscription:** Select your subscription.
2. **Resource group:** Choose existing or create new. Copy and store the Resource group name; you’ll need it to set up PROTECT Management Console.
3. **Key vault name:** Enter a unique name (e.g., `gwprotect-vault-prod`). Copy the name and store it securely. This is the AZURE KEY VAULT NAME that you’ll need to set up PROTECT Management Console.
4. **Region:** Select the appropriate region.
5. **Pricing tier:** Select your pricing.
4. Click **Next**.
5. In **Access configuration,** configure:
* **Permission model:** Select **Azure role-based access control.**
6. Click **Review + Create** and then click **Create.** The **Create** button may appear disabled for a few moments while Azure validates your configuration.
7. After creating the Key vault, go to the Key vaults **Overview** page, and copy the **Subscription ID** and store it securely. This is the AZURE SUBSCRIPTION ID that you’ll need to set up PROTECT Management Console.
{% endstep %}
{% step %}
#### Assign RBAC Roles to the Application (Service Principal)
After creating the Key Vault, you must assign the required Role-Based Access Control (RBAC) roles to the Application, so GuardWare PROTECT can securely access the Key Vault, manage key operations, and control resource-level permissions when needed. These roles ensure the Service Principal has the minimum permissions necessary to perform encryption, decryption, and access management tasks without exposing broader access.
#### **3.1. Assign the Key Vault Administrator role**
This role is required so the Service Principal can fully manage the Key Vault, including creating, updating, deleting, and recovering keys, secrets, and certificates.
1. Navigate to the **Key Vault** that you created and click **Access control (IAM).**
2. Click **Add** and then **Add role assignment**.
3. Search and select the **Key Vault Administrator** role and click **Next**.
4. In **Assign access to,** select **User, group, or service principal**.
5. Click **+ Select members**, search and select the application created during the Microsoft 365 integration (for example, *GuardWare M365 Monitor*).
If you are unsure of the application name, go to **ORGANISATION > Integrations**, copy the **Client ID** or **Tenant ID**, and use it to search for the application in the Microsoft Azure Portal under **App registrations > All applications**.
6. Click **Next** and then **Review + assign.**
#### **3.2.** **Assign the User Access Administrator role**
This role is required so the Service Principal can manage access permissions on the resource. With this role, it can grant, modify, or revoke user and service access when needed, ensuring the correct identities have the appropriate permissions.
1. Navigate to the **Key Vault** that you created and click **Access control (IAM).**
2. Click **Add** and then **Add role assignment**.
3. Click **Role assignments** and then **Privileged administrator roles**.
4. Search and select the **User Access Administrator** role and click **Next**.
5. In **Assign access to,** select **User, group, or service principal**.
6. Click **+ Select members**, then search and select the application created during the Microsoft 365 integration (for example, *GuardWare M365 Monitor*).
If you are unsure of the application name, go to **ORGANISATION > Integrations**, copy the **Client ID** or **Tenant ID**, and use it to search for the application in the Microsoft Azure Portal under **App registrations > All applications**.
7. Click **Next.**
8. In **What user can do**, select the second option: **Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended)** and click **Next**.
9. Click **Review + assign.**
#### **3.3. Assign the Role-Based Access Control Administrator**
This role is required so the Service Principal can not only access the Key Vault, but also update or manage key-related permissions within the resource when necessary.
1. Navigate to the **Key Vault** that you created and click **Access control (IAM).**
2. Click **Add** and then **Add role assignment**.
3. Click **Privileged administrator roles**.
4. Search and select the **Role Based Access Control Administrator** role and click **Next**.
5. In **Assign access to,** select **User, group, or service principal**.
6. Click **+ Select members**, search and select the application created during the Microsoft 365 integration (for example, *GuardWare M365 Monitor*).
If you are unsure of the application name, go to **ORGANISATION > Integrations**, copy the **Client ID** or **Tenant ID**, and use it to search for the application in the Microsoft Azure Portal under **App registrations > All applications**.
7. Click **Next.**
8. In **What user can do**, select the second option: **Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended)** and click **Next**.
9. Click **Review + assign.**
{% endstep %}
{% endstepper %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.guardware.com/protect/key-vault/set-up-azure-key-vault.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.